8a0cbbac766e4f91a5d25b3b8810f31b

Sharing

Copy URL Twitter E-mail

General

Target

8a0cbbac766e4f91a5d25b3b8810f31b
Size

111KB
MD5

8a0cbbac766e4f91a5d25b3b8810f31b
SHA1

b6725217bf3d7e203983ff8415cc9d07f71ab2a4
SHA256

17badacf42f6e4d04880222f8e30e178cee7d2616973b87701f33ca1651ce52c
SHA512

ea9a887b77508c8fa6472c270cce8c6faa061926e2c6515b5eb2d077b224267d28c44e091c4b1a65ab9b719c5869ef64a02db2f054badb81f2aba7e5832df859
SSDEEP

3072:VjN+WJgbDHY3FlZ167Qa2ve/yDAiLGPm0l4tb:9N/A7Y3/6iwyc1jl4l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a0cbbac766e4f91a5d25b3b8810f31b

Files

8a0cbbac766e4f91a5d25b3b8810f31b
.dll windows:4 windows x86 arch:x86

b33183f93f83fce5f73c730142731eab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_beginthreadex
wcstombs
realloc
strncat
wcscpy
_errno
strncmp
_snprintf
atoi
strncpy
strrchr
strcat
_except_handler3
calloc
strcmp
strcpy
malloc
strchr
memcmp
??2@YAPAXI@Z
memset
__CxxFrameHandler
strstr
strlen
_ftol
ceil
memmove
memcpy
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
free
_strcmpi
_strupr
_strnicmp
_strrev
_strnset
??3@YAXPAX@Z

kernel32

SetFilePointer
GetCurrentThreadId
lstrcmpiA
LocalSize
FreeConsole
SetUnhandledExceptionFilter
CreateMutexA
SetErrorMode
OpenEventA
GetSystemInfo
GlobalMemoryStatusEx
OutputDebugStringA
PeekNamedPipe
TerminateProcess
CreatePipe
CreateProcessA
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
WaitForSingleObject
GetFileAttributesA
GetTickCount
MoveFileA
MoveFileExA
CreateEventA
TerminateThread
CreateToolhelp32Snapshot
Process32First
Process32Next
GetLocalTime
OpenProcess
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetDriveTypeA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
RaiseException
WriteFile
Sleep
GetModuleFileNameA
SetLastError
GetSystemDirectoryA
ExitProcess
GetCurrentProcess
GetVersion
DeviceIoControl
CreateThread
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx

msvcp60

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

netapi32

NetLocalGroupAddMembers
NetUserAdd

msvfw32

ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSeqCompressFrame
ICSendMessage

Exports

Exports

Eternal
Heart
ServiceMain

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b33183f93f83fce5f73c730142731eab

Headers

File Characteristics

Imports

msvcrt

kernel32

msvcp60

netapi32

msvfw32

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 101KB

PAGE1 Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 101KB - Virtual size: 101KB

PAGE1
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 6KB - Virtual size: 6KB